Topics /
The most popular blog posts about security & privacy on Hacker News. 612 posts.
Today I'm disclosing a macOS privacy protections bypass. (You may recall that I disclosed another one last year .) The privacy protections system (also known as TCC: Transparency, Consent, and Control) was introduced in macOS Mojave, and one of its purposes is to protect certain files on your Mac from access by…
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
Over 400 vulnerabilities on Qualcomm’s Snapdragon chip threaten mobile phones’ usability worldwide With over 3 billion users globally, smartphones are an %
Slack's TURN server allowed relaying of TCP connections and UDP packets to internal Slack network and meta-data services on AWS.
So I was recently asked why I prefer to use free and open source software over more conventional and popular proprietary software and services. A few years ago I was an avid Google user. I was deep…
Flatpak - a security nightmare
In this post I show some of my findings during the reverse engineering of the apps Coffee Meets Bagel and The League. I have identified several critical vulnerabilities during the research, all of which have been reported to the affected vendors. Introduction In these unprecedented times, more and more people are…
This article was on the hacker news frontpage. You can find the related discussion here. Every developer needs access to some servers for example to check the application logs. Usually, this is done using public-private key encryption where each developer generates their own public-private key pair. The public keys of…
An SQLite database is highly resistant to corruption. If an application crash, or an operating-system crash, or even a power failure occurs in the middle of a transaction, the partially written transaction should be automatically rolled back the next time the database file is accessed. The recovery process is fully…
A look at the new Fuchsia Operating System.
/PRNewswire-PRWeb/ -- Linode, the world's largest independent cloud provider, today announced advanced protection across its global network of 11 data centers...
Ahmad Haghighi’s personal page.
Identify which devices of your company are impacted by five vulnerabilities that Armis found out in the Cisco Discovery Protocol (CPD).
You've possibly just found out you're in a data breach. The organisation involved may have contacted you and advised your password was exposed but fortunately, they encrypted it. But you should change it anyway. Huh? Isn't the whole point of encryption that it protects data when exposed
This is a follow-up to Allan Odgaard's excellent article macOS 10.15: Slow by Design . I want to talk specifically about the first section "Spawning a new Process", because there has been widespread misunderstanding of this. Odgaard provides a simple test to show that the first run of an executable is delayed while…
Spanish translation Communities across the United States are starting to ban facial recognition technologies. In May of last year, San Francisco banned facial recognition; the neighboring city of Oakland soon followed, as did Somerville and Brookline in Massachusetts (a statewide ban may follow). In December, San…
Learn how to use the HTML autocomplete, inputmode and pattern attributes to improve the user experience of logging in.
tl;dr: I like PurelyMail and I will slowly switch all my online accounts to use it. I've been using it for almost three months and I didn't have any issues (except with some Hotmail/Outlook addresses). I have a GMail account since 2006 (that's the date
By Brandon Azad, Project ZeroAt 3 PM PDT on May 23, 2020, the unc0ver jailbreak was released for ...
WASHINGTON – Twitter, Reddit, and Internet Association filed an amicus brief late yesterday in support of a lawsuit filed last year by the Knight First Amendment Institute at Columbia University, the Brennan Center for Justice, and Simpson Thacher & Bartlett LLP on behalf of plaintiffs Doc Society and International…
You probably came here because your Mac showed a message telling you that software from “Objective Development Software GmbH” (Little Snitch) loaded a system extension that will no longer be compatible with a future version of macOS and that you…
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for so...
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
There is now a number, that you can't see, that follows you wherever you go.
COVID-19 has pushed millions of people to work from home, and a flock of companies offering software for tracking workers has swooped in to pitch their products to employers across the country.The services often sound relatively innocuous. Some vendors bill their tools as “automatic time tracking”...
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security…
Tor Browser 10.0.7 is now available from the Tor Browser download page and also from our distribution directory.
